Letsencrypt Official acmetool.sh testing thread for Centmin Mod 123.09beta01

What is going on in here?

Code:

# ./acmetool.sh certonly-issue fiery.me

-------------------------------------------------
acmetool.sh is in beta testing phase
please read & provide bug reports &
feedback for this tool via the forums
https://centminmod.com/acmetool
-------------------------------------------------

continue [y/n] ? y

-----------------------------------------------------
updating acme.sh client...
-----------------------------------------------------
Cloning into 'acme.sh'...
[Tue Apr  3 20:17:59 UTC 2018] It is recommended to install socat first.
[Tue Apr  3 20:17:59 UTC 2018] We use socat for standalone server if you use standalone mode.
[Tue Apr  3 20:17:59 UTC 2018] If you don't use standalone mode, just ignore this warning.
[Tue Apr  3 20:17:59 UTC 2018] Installing to /root/.acme.sh
[Tue Apr  3 20:17:59 UTC 2018] Installed to /root/.acme.sh/acme.sh
[Tue Apr  3 20:17:59 UTC 2018] Installing alias to '/root/.bashrc'
[Tue Apr  3 20:17:59 UTC 2018] OK, Close and reopen your terminal to start using acme.sh
[Tue Apr  3 20:17:59 UTC 2018] Installing alias to '/root/.cshrc'
[Tue Apr  3 20:17:59 UTC 2018] Installing alias to '/root/.tcshrc'
[Tue Apr  3 20:17:59 UTC 2018] Installing cron job
10 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null
[Tue Apr  3 20:17:59 UTC 2018] Good, bash is found, so change the shebang to use bash as preferred.
[Tue Apr  3 20:17:59 UTC 2018] OK
https://github.com/Neilpang/acme.sh
v2.7.8
-----------------------------------------------------
acme.sh updated
-----------------------------------------------------

-----------------------------------------------------------
[DNS mode] issue & install letsencrypt ssl certificate for fiery.me
-----------------------------------------------------------
testcert value =
/root/.acme.sh/acme.sh --staging --issue --force --dns dns_cf -d fiery.me -d www.fiery.me -k 2048 --useragent centminmod-centos7-acmesh-dns --log /root/centminlogs/acmetool.sh-debug-log-030418-201751.log --log-level 2
[Tue Apr  3 20:17:59 UTC 2018] Using stage ACME_DIRECTORY: https://acme-staging.api.letsencrypt.org/directory
[Tue Apr  3 20:18:00 UTC 2018] Multi domain='DNS:fiery.me,DNS:www.fiery.me'
[Tue Apr  3 20:18:00 UTC 2018] Getting domain auth token for each domain
[Tue Apr  3 20:18:00 UTC 2018] Getting webroot for domain='fiery.me'
[Tue Apr  3 20:18:00 UTC 2018] Getting new-authz for domain='fiery.me'
[Tue Apr  3 20:18:02 UTC 2018] The new-authz request is ok.
[Tue Apr  3 20:18:02 UTC 2018] Getting webroot for domain='www.fiery.me'
[Tue Apr  3 20:18:02 UTC 2018] Getting new-authz for domain='www.fiery.me'
[Tue Apr  3 20:18:03 UTC 2018] The new-authz request is ok.
[Tue Apr  3 20:18:03 UTC 2018] Found domain api file: /root/.acme.sh/dnsapi/dns_cf.sh
[Tue Apr  3 20:18:03 UTC 2018] You didn't specify a cloudflare api key and email yet.
[Tue Apr  3 20:18:03 UTC 2018] Please create the key and try again.
[Tue Apr  3 20:18:03 UTC 2018] Error add txt for domain:_acme-challenge.fiery.me
[Tue Apr  3 20:18:03 UTC 2018] Please check log file for more details: /root/centminlogs/acmetool.sh-debug-log-030418-201751.log

---------------------------------
 DNS mode via Cloudflare DNS API
---------------------------------
 setup TXT DNS record via Cloudflare API

It says these:

Code:

[Tue Apr  3 20:18:03 UTC 2018] You didn't specify a cloudflare api key and email yet.
[Tue Apr  3 20:18:03 UTC 2018] Please create the key and try again.

but I got both CF_KEY and CF_EMAIL filled in /etc/centminmod/acmetool-config.ini

---

 

I am on http right now and because of GDPR I want to switch to https.

From what I understand, using the ACME tool will make my site https with an free SSL certificate, is this correct?

And just in case, before I try it, is there anything I have to backup to be sure, so if I fuk it up, I can go back to it? Is this working with php 7.2?

 

@eva2000
I must say it was almost straightforward, nothing to be feared from.
My https works now, thank you.

One little thing though.
Step 9 tells us to do

Code:

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

to force HTTPS as default, which I did. Then I did "nprestart". But still when I visit my site using

Code:

domain.com or www.domain.com

I see the default Centmin Mod Nginx Test Page. Only when I type

Code:

https://domain.com

it works like expected.
Are there any caches involved? Do I have to wait a little longer for the DNS to renew itself?

 

Yes to all of your questions. I don't have any subdomains, just the one top level, but still I included in the HSTS the subdomain, too, to be sure.

I could but I don't expect visitors knowing how to clear HSTS records.

I use Firefox .

 

Did I do sth. incorrectly? Should I remove the subdomain part as I don't have subdomains?

 

It didn't solve the issue.
It seems that once you visit the page by using https, then after that domain.com redirects correctly to https.
But a fresh browser with a first visit using domain.com, still lands on the http page (nginx test page) even though the conf file is disabled for http.

 

Yeah, exactly.

Still same problem.

Here is my ssl-conf file:

I want https only and non-www only.

Spoiler

Code:

# Centmin Mod Getting Started Guide
# must read http://centminmod.com/getstarted.html
# For HTTP/2 SSL Setup
# read http://centminmod.com/nginx_configure_https_ssl_spdy.html

# redirect from www to non-www  forced SSL
# uncomment, save file and restart Nginx to enable
# if unsure use return 302 before using return 301
server {
   server_name www.mydomain.com;
    return 301 https://mydomain.com$request_uri;
 }

server {
  listen 443 ssl http2;
  server_name mydomain.com;
 
  ##  redirect https www to https non-www
      if ($host = 'www.mydomain.com' ) {
         return 301 https://mydomain.com$request_uri;
      }

  ssl_dhparam /usr/local/nginx/conf/ssl/mydomain.com/dhparam.pem;
  ssl_certificate      /usr/local/nginx/conf/ssl/mydomain.com/mydomain.com-acme.cer;
  ssl_certificate_key  /usr/local/nginx/conf/ssl/mydomain.com/mydomain.com-acme.key;
  include /usr/local/nginx/conf/ssl_include.conf;

  http2_max_field_size 16k;
  http2_max_header_size 32k;
  # dual cert supported ssl ciphers
  ssl_ciphers     ... ... ...;
  ssl_prefer_server_ciphers   on;
  #add_header Alternate-Protocol  443:npn-spdy/3;
  add_header Strict-Transport-Security "max-age=31536000;";
  #add_header X-Frame-Options SAMEORIGIN;
  #add_header X-Xss-Protection "1; mode=block" always;
  #add_header X-Content-Type-Options "nosniff" always;
  #spdy_headers_comp 5;
  ssl_buffer_size 1369;
  ssl_session_tickets on;
 
  # enable ocsp stapling
  resolver 8.8.8.8 8.8.4.4 valid=10m;
  resolver_timeout 10s;
  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /usr/local/nginx/conf/ssl/mydomain.com/mydomain.com-acme.cer; 

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  # limit_conn limit_per_ip 16;
  # ssi  on;

  access_log /home/nginx/domains/mydomain.com/log/access.log combined buffer=256k flush=5m;
  error_log /home/nginx/domains/mydomain.com/log/error.log;

  root /home/nginx/domains/mydomain.com/public;

location / {
     index index.php index.html index.htm;
     try_files $uri $uri/ /index.php?$uri&$args;
}



location /install/data/ {
     internal;
}

location /install/templates/ {
     internal;
}

location /internal_data/ {
     internal;
}

location /library/ {
     internal;
} 

# xenforo 2 uncomment / remove hash from next 3 lines
location /src/ {
     internal;
}

  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/php.conf;
  #include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}

Spoiler

Code:

[22:41][root@ ~]# curl -I http://mydomain.com
HTTP/1.1 200 OK
Date: Mon, 28 May 2018 22:46:32 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 4074
Last-Modified: Thu, 08 Mar 2018 20:58:35 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "5aa1a3fb-fea"
Server: nginx centminmod
X-Powered-By: centminmod
Accept-Ranges: bytes

Code:

HTTP/1.1 301 Moved Permanently
Date: Mon, 28 May 2018 22:47:47 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://mydomain.com/
Server: nginx centminmod
X-Powered-By: centminmod

 

Thank you very much, that solved the issue.

The thing is I remember specificially removing this on purpose to have www directed to non-www in http.
And your guide says that we should copy all redirects we have in our http version of conf file to the https version. So I did that. But it seems it was wrong to leave that part out. Sorry for the inconvenience.

 

Me .
I have all dual cert enabled for large sites I have.